Taking work now — the first look is freeSpinning disks in a machine Quicker still, give us a ring:0203 0868633
ADR Advanced Data Recovery 0203 0868633 Price my job
ADR / Evidence, claims and footage / Divorce, probate, company rows

Civil and family matters · what the machine can be made to say

Forensic evidence for civil cases. A file date is an assertion. Only the machine around it settles anything.

In civil cases, the matter differs in your favour compared to criminal cases. An alteration to a document, with a dispute regarding when. A director kept away from records his own company keeps. Divorce money, a contested will, two partners and one deleted file between them. The camera located outside a building next door, which happens to be the sole witness there was. The statutory code administered by the Forensic Science Regulator reaches criminal proceedings and stops there; therefore none of this page is governed by that code, nor does any of it require accreditation. That which applies instead is CPR Part 35 with PD35, and the report is built to answer them line by line. Ascertaining scope costs you nothing; one figure then goes in writing prior to any chargeable work, from £800 + VAT.

The duty runs to the court first Authority agreed before we start Imaged before a folder opens

Talk it over with an engineer, in confidence
0203 0868633

What a file date can and cannot show.

Three dates sit on every fileWhen a file arrives on a volume, Created is stamped; when it is copied somewhere else, that clock starts again. When the contents change, Modified updates. Accessed changes for the most minor of reasons: a backup process or an antivirus scan. All three are equally open to being set manually.
What a deletion really leavesDeleted files usually remain right where they were until the disk needs that space back. Entries stored within an application's database behave differently: some remain available in free pages accessible via carving, while others leave as soon as they are deleted. It is impossible to tell which of these behaviours a particular entry exhibits without investigating it.
A screenshot proves almost nothingNo device exists behind a screenshot; there is no data layer and no hash value. Producing a realistic one takes around a minute, and if you do not say so, the other side will. The computer itself is the evidence.
One date, on its own, settles nothingPlace each date/time stamp adjacent to every piece of additional information that the machine holds, including but not limited to: event logs, last opened documents, backup records and synchronisation history. Either the rest of this information corresponds to the timestamp in question or it does not, and identifying which is the work.

Every Part 35 rule, and how this bench meets it.

Not listed? Tell us what it does →
Rule citedWhat it demandsHow we satisfy it
CPR 35.3: the first dutyFirst and foremost, experts assist courts, not those who are funding them. As such, their obligations to the court are superior to all obligations to their funders.This is stated at the beginning of each report, and each finding listed below it answers to that statement.
CPR 35.4: permission from the courtEach application for permission must specify the area(s) of expertise, the issues the expert is expected to address, and a preliminary estimate of the costs.You receive the written scope and the figure in time to put both into the application
PD35 at paragraphs 3.2 and 3.3Regardless of how many different opinions there might be, there are nine required elements to include in the report, followed by a statement of truth worded exactly as the direction words it.All nine requirements are satisfied, and the examiner is identified.
CPR 35.7: one expert for both partiesThe court can order a single expert to provide evidence at its discretion, with the understanding that this expert is providing the evidence on joint instructions.We agree to accept joint instructions, and both parties will receive the exact same report.
CPR 35.6: questions put in writingA single round of follow-up clarification questions, which can be asked within 28 days.Answers are to be in writing, and these will become part of the report.
How it reaches us: get a straight quote first (via phone or form), then send it via tracked, insured post or drop it off at our Guildford intake lab, Monday to Friday, 9am to 5:30pm (no appointment needed); our Guildford lab takes it in, and the cost of sending it back to you is on us. Unsure what to put with it when sending it to us? Give us a ring before sealing your box and we'll put you through to an engineer who can tell you what you need to include and what needs to stay behind. All of this information is also outlined on our guide to packing and posting.

The sequence we follow.

Other jobs on the log →
01

Say what has happened, in confidence — then a figure in writing Free

Our forensic charges start at £800 + VAT. The amount charged depends upon the size of the task at hand, and that is determined in the course of our first telephone conversation: dates and events in dispute; machines and accounts involved; what needs to be demonstrated. There is no charge made for the initial telephone call. Furthermore, nothing that you would be billed for commences until a written fee quotation has been delivered to you.

That call goes no further than usA single figure, put in writingThe questions evidence must settle
02

The image comes before the look

It's not ceremonial. There is a complete image available prior to opening the first folder. If you open a folder first, the dates the case may turn on could shift underneath you. To make matters worse, the other party receives an additional question for free: who selected which folders were worthy of review? Here, we select none and filter nothing.

The copy comes before anythingNothing opened beforehand
03

The original is stored; the work runs on the image

The original is stored in access-controlled storage and stays there, and all subsequent actions will occur based upon the image: the document(s) at issue; what the file system contains relative to each document; any deleted materials that could potentially be recovered by carving; and any notes the machine made regarding the drive(s) connected, account(s) signed into, or data being synced. In cases where two dates appear to conflict with one another, the report will state which date it believes should be preferred, along with an explanation for that preference.

Documents, mail, messagesCarved-back deleted material
04

The report is written for the court

Under PD35, a report is addressed to the court and not to the party funding it, and therefore the language utilised in the report is directed towards the court. The qualifications open the report. Next come the materials upon which reliance was placed, an outline of the substance of our instructions, who performed the analysis, and, when appropriate, a representation of differing opinions. Finally, a statement of truth (worded as PD35 prescribes) concludes the report. Accreditation was already addressed on page one.

Written to CPR Part 35 with PD35A signed statement of truth on it
05

What the bundle holds, and who signed for it

Hand the opposite side a finding they have no way to verify, and the argument is theirs. So the bundle contains everything: each exhibit numbered, the hash values for each, dated and countersigned handovers, the images used for the conclusions reached, and the bench notes created whilst the work was ongoing. Repeat the steps and the result does not change.

Each finding tied to an exhibitHashes taken, and each handover loggedEvery step can be repeated

What the bench has learned

  • When working with families, authority is always the determining factor: the same family computer used by both of you, which neither would call solely theirs; a laptop purchased by one party but used by both parties; a company machine a director never handed back. There will be three different factual bases, and consequently, three different answers.
  • Without authority, there is no job, and that is far beyond mere paperwork for its own sake. Unauthorised access violates the first section of the Computer Misuse Act 1990, and a laboratory is not exempt from such violations.
  • Cheap providers often overreach at exactly this point: a created date is supplied as though it has already been resolved, without regard to the method through which it was obtained. Dates on disks change very quickly. Copying resets the created date, restoring resets it again, and at some point the clock may never even have been properly set. Our dates carry the qualification with them.
  • We don't take handsets at our bench: all we get are computers, drives and cards, and backups of phones which were backed up on a computer. If your issue relates to the actual handset, please state this when you call and we'll tell you where to go.

The question solicitors raise first: as stated in CPR 35.10, the substance of every material instruction provided either verbally or in writing must appear within the body of the report, and privilege will not prevent it from being included. The safeguard resides within the same rule: neither the underlying documentation nor cross-examination regarding these documents will be permitted unless the court determines the statement of instructions to be incomplete or incorrect. Knowing this fact during the drafting of your letter of instruction would prove useful. Regarding the statement of truth, the wording thereof is dictated by PD35 3.3, and the direction clearly warns that signing one without an honest belief constitutes contempt.

One job, followed all the way through.

LDN · ADR-2026-3413JOB LOGGED ✓

The file was older than the machine holding it

Two partners in Hackney could not agree about their accounts, and one partner presented documentation dated prior to their separation. The computer used to produce the documentation was purchased after they separated, and the record held within the file agreed with the disk. Our report included the date, explained how this date had been established, and also noted plainly that nothing on that drive showed which person had used the keyboard. Settlement occurred shortly thereafter.

At an end and no hearing was neededThe order of events settled between both sides

What helps, and what harms.

Do this much first

  • Determine who is authorised to direct or permit the inspection of the machine.
  • Do not touch the machine: every hour it operates will potentially move forward any relevant date you wish to use.
  • Identify in the instructions what facts are actually being contested.
  • Raise early whether one joint expert would meet the court's requirements.

What sets us back

  • Submitting a device you have no authority to submit.
  • Having a look at it yourself.
  • Providing screenshots when only the machine itself will do.
  • Deleting the contents of the drive prior to imaging.

The questions that come up first.

Is any of this covered by the statutory Code?

It is not, and the reason is worth spending one minute looking into. The Code administered by the Regulator applies only to criminal cases, only in England and Wales, and the standard it names there is ISO/IEC 17025. A disagreement regarding a boundary is not a criminal case. Nor is a request for a financial remedy, nor is a dispute between directors. In any event, this laboratory does not hold any type of accreditation for any kind of work, and page one of each report clearly states that.

Which machines am I entitled to send?

Only those released to you by someone with the right to give that permission. Reading a machine you have no authority to access is a section 1 offence under the Computer Misuse Act 1990, and a laboratory answers to it just like you do. A shared household computer, a machine one of you paid for, a machine that is plainly theirs: there are three types of facts, and there are three different answers. Raise these issues with your solicitor prior to sending anything.

How much does a created date really prove?

That a particular file arrived on a particular volume at a particular moment: that is all it establishes, and nothing more than that. When those words were created and who created them remain unaddressed. If you copy the file, then that resets the value. A clock can be turned backwards by hand in less than a minute. The modified date moves, the accessed date moves, and frequently nobody intended either. Until other parts of the machine support its claim, a date is merely an assertion.

Can deleted messages be retrieved?

It depends upon where they were kept. Computers, drives and cards can be examined here; mobile phones cannot be examined at all. Deleted entries from an application database can reside in free pages (for example, a browser history file, an email client on the desktop, or a backup of a telephone on a computer) as long as nothing claims that space. As soon as something else resides in that space, there is nothing to restore.

Begin here if yours is doing the same thing.

What a forensic job involves → What goes into the report → What is left after a delete → Work that reaches court →

Off the mains first, because that is what protects the evidence.

Regardless of what contains the evidence, turn off electrical power to it before doing anything else: a recorder still operating overwrites its oldest evidence every hour. Once power is removed, secure a price quotation (either by phone or through submitting a form), then post us just the disk or drive (do not include the recorder or computer), or drop it off at our Guildford intake lab, Monday to Friday, 9am to 5:30pm (no appointment needed). Evaluation costs nothing; work on recorders costs £400 + VAT and forensic analysis starts at £800 + VAT, both prices agreed to in writing beforehand. What sits on that disk stays here.

0203 0868633

Price my job Sending it to Guildford